CVE-2019-11480

Summary

The pc-kernel snap build process hardcoded the –allow-insecure-repositories and –allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a malicious package within the build chroot. This issue affects pc-kernel versions prior to and including 2019-07-16

Affected Software

VendorProductVersion RangeStatus
Canonicalpc-kernelunspecified <= 2019-07-16affected

Weaknesses

  • CWE-353: CWE-353: Missing Support for Integrity Check

ADP Enrichment

CVE Program Container

Additional References

References